Free Malware Removal Forum

Welcome to MalwareRemoval.com,What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

I'm always redirected to another, unrelated site whenever I attempt to click on a result from any search engine. I have attempted to use MalwareBytes, Spybot, Adaware to no avail. I've attempted Combofix, but had to stop it when it was deleting strange files like my Steam.exe. When I click on a search result, I can make out that it goes to something called "thewebtimes.net" or "goingonearth.com" before I'm sent to another site or my no script directs me back to my search engine.

Also, whenever I attempt to start up my Windows Security Center Service, I get an error message reading "The Windows Security Center Service cannot be started."

Zetsubera,-----------------------------------------------Please Note Our Policy on the Use of P2P (Person to Person / Peer to Peer) file sharing programsIt is posted here: http://malwareremoval.com/forum/viewtopic.php?p=491394#p491394As a condition of receiving our help, I have included the P2P program BitTorrent in the removal instructions below, so we are not wasting our time.If you have used this, and your computer is infected, you can be fairly confident this is a principal reason.

It's really important, if you value your PC at all, to stay away from P2P file sharing programs, like utorrent, Bittorrent, Azureus, Frostwire, Vuze, Shareaza, Bitlord.(Limewire has been shut down by the courts).Criminals have "planted" thousands upon thousands of infections in the "free" shared files. Virtually all of these recent infections will compromise your Security, and some can turn your machine into a useless "doorstop".------------------------------------------------Remove Programs Using Control PanelFrom Start, Control Panel, click on Uninstall a program under the Programs heading.Right click each Entry, as follows, one by one, if it exists, choose Uninstall/Change, and give permission to Continue:Ad-AwareBitTorrentSpybot - Search & Destroy

Take extra care in answering questions posed by any Uninstaller.If the Spybot Uninstaller asks whether you want to remove all files and settings, answer YES. If it reports that it cannot remove all files, that's OK.-----------------------------------------------------------REBOOT (RESTART) Your Machine---------------------------------------------Please download SystemLook from one of the links below and save it to your Desktop.Download Mirror #1Download Mirror #2

Note: You can use either Internet Explorer or Mozilla FireFox for this scan.

Note: If you are using Windows Vista or Windows 7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

First please Disable any Antivirus you have active, as shown in This topic.

Note: Don't forget to re-enable it after the scan.

Next hold down Control then click on the following link to open a new window to ESET online scannner

Then click on Run ESET Online Scanner

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

Select the option YES, I accept the Terms of Use then click on Start.

When prompted allow the Add-On/Active X to install.

Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.

Now click on Advanced Settings and select the following:

Scan for potentially unwanted applications

Scan for potentially unsafe applications

Enable Anti-Stealth Technology

Now click on Start.

The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.

When completed the Online Scan will begin automatically.

Do not touch either the Mouse or keyboard during the scan otherwise it may stall.

When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!

Now click on Finish.

Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.

Return to OTM, right-click in the "Paste instructions for items to be moved" window (under the yellow bar) and choose Paste

Then click the red MoveIt! button.

Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of it and pressing CTRL + C (or, after highlighting, right-click and choose Copy), and paste it into your next Reply.

If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot. Please copy and paste the contents in your reply.

Close OTM.

Note: the logs are saved in C:\_OTM\MovedFiles\ if you need to retrieve one.

Zetsubera,OTM found the files and appears to have removed them.------------------------------------------------Game Booster changes some system settings and shuts off some services in its attempt to improve gaming performance.It is most likely responsible for some of the behavior you are seeing.Game Booster is published by a company with a very questionable history.

Remove Programs Using Control PanelFrom Start, Control Panel, click on Uninstall a program under the Programs heading.Right click each Entry, as follows, one by one, if it exists, choose Uninstall/Change, and give permission to Continue:Game Booster

Take extra care in answering questions posed by any Uninstaller.I have no idea whether the program will automatically return any of your settings to normal.----------------------------------------------------------------------------------Download and Run MalwareBytes' Anti-Malware It is free for non-business use.Please go here to the Download Location, click on Download.

After clicking on the download and choosing Save, the "Save to location" dialog will come up.

Click the browse folders button, then click on Desktop on the left as the location for the installer and click Save again. Close the dialog when the download is complete.

You should now have a desktop icon named mbam-setup.exe.

Right click it, choose Run as administrator and Continue

Let it install where it wants to, with the default settings, and click Finish.

If an update is found, it will download and install the latest version. A shield symbol will show on the desktop icon while it is updating, and will disappear when it's done.

If necessary, start Malwarebytes Anti-Malware again.

Once the program has started up, select Perform Quick Scan, then click Scan.

When the scan is complete, click OK, then Show Results to view the results.

If it found any malware items, check all items except items in the C:\System Volume Information folder... and click Remove Selected.

When completed, a log will open in Notepad. Please save it to a convenient location, and post the contents in your reply.

The log can also be found using the "Logs" tab in the program. You can click any "Scan" log listed to open its contents. The logs are listed and named by time/date stamp.

Return to OTM, right-click in the "Paste instructions for items to be moved" window (under the yellow bar) and choose Paste

Then click the red MoveIt! button.

Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of it and pressing CTRL + C (or, after highlighting, right-click and choose Copy), and paste it into your next Reply.

If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot. Please copy and paste the contents in your reply.

Close OTM.

Note: the logs are saved in C:\_OTM\MovedFiles\ if you need to retrieve one.

As I mentioned, any other misbehavior is likely related to settings made by Game Booster.

Files moved on Reboot...C:\Users\Kevin\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

After the reboot, I tried a google search of "wikipedia". Clicked a result, first time got through, did it again and got the "goingonearth" address then my Noscript sent me to Google. And my Windows toolbar still notifies me of my Windows Security Center still being off and I'm still unable to switch it back on.

Use Notepad's File, Save As to save it to your desktop as File type All Files (not as text file or it won't work), and file name FixSvc.batExit Notepad.Right click FixSvc.bat and choose "Run as administrator"A Command window will flash on and off.-----------------------------------------------Please download MiniToolBox and run it.Check ONLY the following in the list:

Flush DNS

Click GO and post the result (Result.txt).---------------------------------------------Delete OTM.exe from your desktop. You won't need it again.Run a Scan with OTL

Who is online

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.